HIGH 8.2 Go
Gitea allows attackers to add attachments with forbidden file extensions
GHSA-263q-5cv3-xq9g · BIT-gitea-2025-68939 · CVE-2025-68939 · GO-2025-4261
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-68939
- WEB https://github.com/go-gitea/gitea/pull/32151
- WEB https://github.com/go-gitea/gitea/commit/7adc4717ec8e4f8fe678010866e936cf024f498d
- WEB https://blog.gitea.com/release-of-1.23.0
- PACKAGE https://github.com/go-gitea/gitea
- WEB https://github.com/go-gitea/gitea/releases/tag/v1.23.0
Ready to move
Start Securing
Free, no credit card | First findings in minutes